Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Today’s cyber risk environment is defined by a convergence of high-impact vulnerabilities, evolving AI governance challenges, and persistent threats to our supply chains and cloud-based operations. We’re seeing a steady stream of critical software flaws being actively exploited in some of the most widely used enterprise platforms—including Cisco Unified Communications Manager, Microsoft Exchange, and Ubiquiti UniFi OS. These incidents aren’t isolated; they’re part of a broader trend where attackers are increasingly targeting the core infrastructure that organizations rely on every day, from telephony to code repositories to cloud management layers.

Let’s start by looking at the vulnerabilities that are making headlines right now. First up is a critical flaw in Cisco Unified Communications Manager, tracked as CVE-2026-20230. This vulnerability is being actively exploited in the wild, with attackers deploying webshells to gain persistent remote access. For those unfamiliar, Unified CM is a backbone for enterprise telephony and collaboration—so a compromise here isn’t just about a single server; it’s about the potential for attackers to move laterally and compromise sensitive communications across the organization.

The practical implication is clear: if you haven’t already, patch immediately. But patching alone isn’t enough. A forensic review is warranted to ensure that no unauthorized access has already occurred. This is a textbook case of why rapid vulnerability management and network segmentation are essential, especially for critical voice and collaboration systems. If you’re a CISO or security leader, now is the time to double-check that your telephony infrastructure is isolated from other sensitive assets and that you have robust monitoring in place for suspicious activity.

Next, let’s talk about the software supply chain. Security researchers have identified exploitable vulnerabilities in popular CI/CD platforms—those continuous integration and continuous deployment systems that power modern DevOps. The scale of this risk is enormous: millions of code repositories could be hijacked if these flaws are left unaddressed. Attackers can inject malicious code or steal sensitive credentials, threatening the very integrity of the software supply chain.

If your organization relies on automated build and deployment pipelines, it’s critical to review your access controls, audit pipeline configurations, and monitor for anomalous activity. This is especially urgent for enterprises with complex DevOps environments and multiple third-party integrations. The lesson here is that automation without oversight can quickly become a liability. Make sure your DevOps teams are working closely with security to lock down these environments and that you’re continuously monitoring for signs of compromise.

The U.S. Cybersecurity and Infrastructure Security Agency—CISA—has also updated its Known Exploited Vulnerabilities catalog. They’ve added critical flaws in Ubiquiti UniFi OS and Lantronix EDS5000 plugins. These vulnerabilities are being actively targeted, and attackers could use them to gain unauthorized access or disrupt network operations. If you have these devices in your environment, prioritize patching and consider network isolation for affected systems. The fact that CISA has included these issues in its catalog should be a wake-up call: these aren’t theoretical risks, and regulatory scrutiny will only increase if organizations fail to act.

Shifting gears to the mobile landscape, we’re seeing a persistent threat from malware distributed even through official app stores. A recent campaign involved a malicious Android app disguised as a document reader. It managed to rack up over 100,000 downloads on Google Play, distributing remote access malware to unsuspecting users. This highlights the ongoing risk of mobile malware, especially in bring-your-own-device environments and among remote workforces.

For security leaders, the takeaway is to reinforce mobile device management policies and educate users about app vetting and permissions. Even when apps come from official sources, due diligence is essential. Consider implementing mobile threat defense solutions and ensure that your incident response plans include scenarios involving compromised mobile devices.

Phishing remains a perennial threat, but attackers are getting more creative in their approach. The Woodgnat threat actor is using themed phishing lures—like ClickFix, FileFix, and CrashFix—to deliver remote access malware. These lures are designed to look like legitimate tools, increasing the chance that users will interact with them. The campaign uses both email and drive-by downloads, making it a multi-pronged threat.

To mitigate this, organizations should focus on robust email filtering, ongoing user awareness training, and strong endpoint detection and response capabilities. The goal is to reduce the likelihood of initial compromise and to detect and contain any incidents quickly. Remember, phishing is as much a human problem as it is a technical one, so ongoing education and simulation exercises are key.

Another critical issue is a recently disclosed Server-Side Request Forgery—or SSRF—vulnerability in Microsoft Exchange’s EWS service. A proof-of-concept exploit has been released, which means attackers now have a roadmap for targeting internal services via unpatched Exchange servers. The public availability of exploit code always accelerates the risk of widespread attacks, so immediate patching and enhanced network monitoring are non-negotiable. Left unaddressed, this flaw could lead to data exfiltration or facilitate further lateral movement within your network.

Webmin, a widely used server administration tool, is also in the spotlight due to a stored cross-site scripting—or XSS—vulnerability. This flaw could allow untrusted users to escalate privileges and exploit root accounts, potentially leading to full system compromise. Given Webmin’s role in managing critical infrastructure, organizations should patch promptly and review user access to administrative interfaces. Limiting access to trusted personnel and enforcing multi-factor authentication can provide additional layers of defense.

Now, let’s turn to an often-overlooked area: non-production data. Test and development environments are frequently neglected when it comes to governance and security, but they can contain sensitive information that’s just as valuable to attackers as what’s in production. Poorly managed non-production data increases the risk of breaches and compliance violations.

CISOs should inventory all non-production environments, enforce data masking, and integrate these assets into broader data governance frameworks. Treat test and dev data with the same level of scrutiny as production data, especially when it comes to access controls and monitoring. This is particularly important for organizations subject to regulatory requirements around data privacy and protection.

AI is another area where risk profiles are evolving rapidly. Across sectors like insurance, pensions, and among small and medium-sized enterprises, governance is emerging as the primary challenge—not just regulation. Effective AI governance requires tailored oversight, robust data management, and clear accountability structures. China’s continued engagement in global AI governance adds another layer of complexity for multinational organizations, as regulatory expectations continue to shift.

For boards and executive teams, AI governance is now a top-tier issue. It demands cross-functional collaboration, with input from legal, compliance, IT, and business units. Sector-specific oversight is essential, as the risks and requirements can vary significantly from one industry to another. Organizations should be proactive in developing AI governance frameworks that address data quality, transparency, and ethical considerations, as well as technical security controls.

Australia’s prudential regulator, APRA, has issued a notable warning on AI risks, urging financial institutions to “fight fire with fire” by adopting AI-driven defenses against AI-enabled threats. This reflects a growing consensus that traditional security controls are no longer sufficient in the face of sophisticated, automated attacks. Proactive, intelligence-driven security is now essential.

Security leaders should evaluate the AI-based security tools available in the market, ensuring that their defenses can keep pace with the evolving threat landscape. This includes everything from AI-powered anomaly detection to automated incident response. At the same time, it’s critical to ensure that these tools align with evolving regulatory expectations and that their deployment is transparent and accountable.

The application security landscape is also evolving. A new ranking of top application security tools for 2026 highlights the rapid pace of change driven by AI, cloud adoption, and the growing complexity of attack surfaces. Security leaders should regularly assess their tooling portfolios to ensure they’re covering emerging threats, integrating with DevOps workflows, and supporting AI-driven risk analysis. The days of set-and-forget security tools are over; continuous evaluation and adaptation are now required.

Small and medium-sized enterprises—SMEs—make up 90% of global businesses, and their adoption of AI is transforming both their opportunities and their risk profiles. These organizations face unique challenges in data governance, security, and compliance, often without the resources of larger enterprises. CISOs supporting or partnering with SMEs should consider tailored risk management approac